CVE-2026-40333

CVE-2026-40333 is a medium-severity vulnerability in libgphoto2 versions up to 2.5.33, affecting the camera access and control library. Two functions in camlibs/ptp2/ptp-pack.c lack length parameters when accepting data pointers, allowing unbounded reads that exceed actual buffer boundaries. The vulnerability stems from callers in ptp_unpack_EOS_events() having available size information but failing to pass it to the vulnerable functions. The vulnerability presents a physical attack vector requiring local access, with no elevated privileges needed. With low complexity requirements, successful exploitation could result in high impact through confidentiality breaches via information disclosure and high availability impact through denial of service. The CVSS score of 6.1 reflects the medium risk level, though the EPSS score of 0.0002 indicates relatively low prevalence compared to other CVEs. There is no evidence of active exploitation, no public exploit code availability, and the vulnerability is not on the KEV catalog or hot list for active monitoring. Community attention appears minimal given the low EPSS score and inactive status. The issue has been addressed through commit 1817ecead20c2aafa7549dac9619fe38f47b2f53, which patches the unbounded read vulnerability.